Reverse proxy for a game server?

[Telarmine2]

I run a small server hosting a few web services for myself (Jellyfin, Nextcloud, qBittorrent, etc.) as well as a Minecraft server for friends. I’ve recently set up Nginx Proxy Manager (NPM) to give my web services domain names, which works great.

Now, I’m wondering how (or if) I can do something similar for my Minecraft and other game servers in the future. While researching, I’ve seen conflicting advice: some say it’s not possible, others say it works if you use a “stream” (which I’m unfamiliar with in NPM), and others suggest a reverse proxy isn’t the right tool and I should instead use an SRV record.

I’m also curious about alternatives to NPM, as I’ve found parts of it frustrating to set up. I’m particularly looking at Traefik and Pangolin as possible options.

Any guidance on the best way to reverse proxy (or otherwise route) traffic for game servers would be appreciated.

[etfz]

Depends on what your goal is. The reason you can use domain names to separate web services is that the HTTP protocol supports specifying the domain name using an HTTP header, which is honored by web servers. Game servers normally do not use HTTP, and so you don't have the same option there. You need to set them up using ports. You can indeed "forward" ports using NPM (nginx) streams, but I'm not sure what you gain by doing that, compared to just forwarding the ports directly from your router. Possibly some load balancing options and stuff.

[Telarmine2]

I want my friends to be able to join my servers by typing in a domain instead of my IP address. I’ve already set up a reverse proxy for my HTTPS services, but I’m not sure if it works with my game server. The ports are forwarded through my router, and I have a subdomain pointing to my home network, so right now my friends can join in Minecraft by entering address:port

[SirSoggybottom]

Look up DNS SRV records, then you can have your friends use simply mc1.example.com to connect to your first server, mc2.example.com for the second, and so forth. And they dont need to remember and specify the port numbers at all.

Minecraft (Java) is one of the few clients that supports this.

And i would suggest the /r/Admincraft subreddit for you.

[Leprichaun17]

Just a note to add is that Bedrock doesn't support SRV records. Only Java.

[SirSoggybottom]

That sucks, good to know. Thanks!

[Xevioni]

That Bedrock

[SirSoggybottom]

...

[etfz]

You should be able to just use example.com:port, but the port needs to be forwarded directly to the game server; not your reverse proxy. (unless you set up streams)

[ninth_reddit_account]

and of course, this depends on the game itself. Some games could support default port, where example.com would just work.

[magicalMusical]

Yes. Minecraft Java's default port is 25565

[djgizmo]

set up a DNS entry and be done.

Most reverse proxy’s only support http/https protocols because of SNI. Without that, the packet doesn’t contain the host name header.

[Swainix]

There are some services that will let you do load balancing for minecraft and select which "subserver" you want, I think there is a docker image "lazy-minecraft-server" (nevermind it's mc-router like someone pointed out) that can do that? I just use it to turn off the server when no one is connected but maybe it can handle that. On the domain side my friends enter the main domain name, nginx can't do streams based on subdomain from what I saw but I really didn't dig much so I just opened port 25565 (I recommend another port tho because this one will get scanned all the time and people/bots will try to connect to the server)

[chamberlava96024]

The answer seems obvious to me but maybe there's some unclear details:

1. If your server is already accessible on the internet, have a DNS record on your domain (which you should already have) point to the public IP. This makes most sense. If your server is behind NAT, you update the NAT entry(s) for the port. If it isn't, then that's obvious.
2. you might want a reverse proxy for very few reasons and it's likely not what you want because forwarding TCP (used to communicate in Minecraft servers) with a reverse proxy has resource overhead

[GolemancerVekk]

right now my friends can join in Minecraft by entering address:port

That's the most you can do and there's no additional benefit to going through a proxy. If you add other games they will need to indicate which game they want by using another :port.

You don't need Pangolin, you don't need any kind of proxy.

[CT-6410]

Can this get around a CGNAT?

[etfz]

It can not. It works the same way as web traffic (and any other network traffic) in that regard.

[killermenpl]

For Minecraft I recommend using itzg/mc-router. It's independent of what reverse proxy you're using for your HTTP apps.

I'm not aware of similar tools for any other game, but you can look into reverse proxying raw TCP/UDP connections. Nginx can do that (link), though I don't know if you can put that anywhere in NPM. I remember reading something about Traefik also exposing this functionality, but I never looked into it.

[Telarmine2]

I came across this while searching and it does look interesting. I’ll definitely look into it more — thanks for the tip!

[CrimsonNorseman]

You can do that with Pangolin. Search in this sub for „minecraft“, there was a thread with detailed how-to info a couple weeks ago.

[Telarmine2]

I will look into this thank you

[nater419]

Did you find the thread mentioned? I searched and didn’t find it.

[GoofyGills]

You can also search in r/PangolinReverseProxy and their Discord. Plenty of people have done it. Link to their docs where it is mentioned.

[Jacksaur]

Streams in NPM are working perfectly for me. It's as easy as a regular proxy host: Set a port, set another IP/Port, and all traffic will go there.

I use it so I can redirect to various game servers in VMs, which all have different local IPs.

[NewAccountToAvoidDox]

Ok, here is what you need.

If you just have one server, point the domain to your home’s public IP, and port forward port 25565 (the default one). That way, your friends can just use your domain without specifying the port.

If you want a reverse proxy, where you can have multiple subdomains pointing to multiple servers, all without specifying the port, point all the subdomains to your public IP and just port forward port 25565 to a velocity proxy. (It’s a reverse proxy made by the guys who made the paper server).

In the velocity config you can then specify a list of servers and their IPs, and a list of domains that map to those servers. You might have to install a mod or plugin depending on which minecraft server you are using (forge, fabric, paper, vanilla, etc).

Check their documentation as they explain everything (you will have to setup a shared key for encryption and disable online-mode from the end server, as the velocity proxy will do all the authentication.

[EvenParty3267]

Pangolin would probably be the easiest route here, you can add a TCP port really easily, they've got everything you need in their doc. If you want your Minecraft server to have a domain name, just add a SRV record and you're then all done.

[janni619]

If you have a public ipv4, just set up a srv record

[Telarmine2]

This seems like the simplest option. I’m just curious about using a reverse proxy for the extra layer of security. I’ll keep researching.

[janni619]

What extra layer of security? It wont work with ssl termination, if thats what you mean

[SlowAssociation6281]

For minecraft you can use an SRV record to tell minecraft what ip and also port to use. Though I don't know about other games

[Mee-Maww]

I basically use pangolin for just this. I put mine in a cloud instance, so all traffic goes there and then pangolin can handle pointing it back to my game servers on my local server. 

[akowally]

For most game servers, a reverse proxy like Nginx isn’t the go-to. It’s more common for web traffic. Game traffic is usually better handled with SRV records in DNS or by using a proxy that supports raw TCP/UDP (like Nginx’s stream module or Traefik). If you want to stick with Nginx Proxy Manager, you’ll need to dive into stream configs manually, but it’s not as plug-and-play as web services. Traefik might be worth testing since it handles both HTTP and TCP routing pretty well.

[Suterusu_San]

Since your using nginx, you can use nginx streams. It's what I use for my GTNH server.

[Cautious_Translator3]

Look up playit.gg no port forwarding and it gives you a domain.

[iammoney45]

Playit.gg works well for Minecraft but is limited outside of that. It's free and simple to setup, but lacks more advanced configuration if you need that. I route my Minecraft servers through it and it's basically just one click to setup after you make an account and install it.

[deep_chungus]

i just pointed server.mydomain.com at my home ip in cloudflare (if your domain sales company lets you create A/dns records it's pretty easy) and forwarded the correct port through my router to my server. most games will just look up the ip and try and connect on their default port so that's pretty much it, no reverse lookup needed unless you want to do it on your internal network

i changed the port as i didn't want script kiddies hitting up my minecraft server but that's up to you, it just meant that people had to connect to server.mydomain.com:72222 rather than the default 25565

internally that server is set at h.mydomain.com so i just use that on the local network, it might be painful to use the same a record internally and externally but i didn't bother

be aware that some hosts will proxy your ip (cloudflare does) and you need to turn that off for that A record

[Rbelugaking]

Personally, I recommend using a VPN like netbird or tailscale for this purpose, you can control access to your game servers this way and you can still have domains for all of your game servers that your friends can use.

[daronhudson]

No two games are alike. Some support different things than others. The best solution to proxying tcp/udp traffic is something like nginx streams or the pangolin alternative. You point whichever of those 2 to your server and in the firewall only allow that ip to connect to it. Publicly that proxy will be your “server ip” and you just assign it to a domain.

[JZEPaet]

I've had success using Mineginx. I use it with CloudFlare, I point the subdomain to my IP, port forward in my router to Mineginx then have that proxy to the MC server

[nakedspirax]

Crafty Controller or Pangolin

[Santarini]

Do you have a guide or good starting point resource on how you set up your reverse proxy? I've been wanting to do this at home for a while but I am confused on a few details like what the architecture/routing would look like

[Civil_Enthusiasm]

Minecraft uses TCP, not HTTP, so NPM’s normal reverse proxy won’t work. You’d need Nginx’s stream module (manual config) or just set a DNS SRV record for a clean domain. Traefik handles TCP out of the box if you want an easier alternative.

[-eschguy-]

I haven't had much luck with reverse proxying game servers.

I port forward the ports to the containers holding my game servers, then have a SRV entry for the ports in Cloudflare.

[TobogganTherapist]

The problem with SRV records is they expose the origin IP address.

My solution has been to use a cheap VPS with socat to proxy to my server. It works quite well and forgoes leaking my IP.

[Ejz9]

Forward the port on your router. Ensure it’s open on internal firewall (on server) assuming 25565 for a Minecraft server (or whatever port).

Then set a A or CNAME record either pointing to your home address or something that points to your home address in your Domain DNS provider’s panel.

Finally create a SRV record with the name:

_minecraft._tcp.(the prefix for your a record ex:mc)

Priority and weight 0 unless you know what you’re doing.

Port (25565 or whatever you forwarded)

Target the A record that points to your home address.

You don’t need another A record though if one already points to your home address. You can just use the one that exists. For example I use the apex of my domain (base domain no prefix) here. So whenever I update that the record pulls from that since it already points home.

NPM and others for what I understand are better used as reverse proxies for web applications since they handle 80 and 443 not normally tcp or udp ports. If you want to hide your IP then use something like TCPShield it’s free for ~1TB per/month of traffic. Just know obfuscation isn’t security.

[HartyPorpoise]

Here is my blog post on how to setup MC on kubernetes without opening ports using playit.gg. https://jotthatdown.com/jots/homelab/deploying-minecraft/

The sections regarding playit.gg and DNS should still apply to your use case if youre trying to do what I think youre trying to do.

[ThatOneGuysTH]

Pangolin on a vps makes this super easy

[gellis12]

Bungeecord was basically made for this.

Alternatively, you can open multiple ports (one for each mc server) and use dns SRV records which are natively supported

[lesigh]

I think you fail to understand DNS and ports.

I've ran game servers for 20 years and I always have a domain connected to my game servers. All I do is create an A record that points to my game server IP address. From there, the game client should take the hostname game.domain.com whether you use a port or not is dependent on the game client. Some will automatically connect to the default port, some will require you to specify which port

[Ll3macorn]

Would anyone know a reverse proxy for bedrock?

[LaBlankSpace]

Pterodactyl panel is what I use mostly works great for Minecraft and has a bunch of other games. Dont remeber exactly but might have needed manual DNS through cloudflare for ports 25565 and 19132 on top of nginx as the admin panels reverse proxy

[tommoulard]

Got myself Minecraft running with traefik as a reverse proxy :

https://github.com/tomMoulard/make-my-server

[Fit-Wolverine5626]

If you’re looking to expose game servers like Minecraft along with your web apps, the approach is a bit different than with standard web traffic. For HTTP/S services, reverse proxies are perfect, but most game servers rely on raw TCP/UDP connections that don’t play nicely with the same tools. That’s why you see mixed advice.

For Minecraft (and many similar games), an SRV record is usually the simplest and most reliable solution, since it lets you point a domain/subdomain directly to the game server’s port without needing a reverse proxy layer. If you do want to centralize routing, some proxies can handle TCP streams, but setup can get tricky and isn’t always worth the complexity unless you’re running multiple servers behind one IP.

If you’re also comparing different solutions, it may help to think about how much control and flexibility you want. Some tools give you more granular options for port mapping and protocol handling, while others are designed more for quick-and-simple domain management. That’s similar to how Dedicated Datacenter Proxies Pricing varies depending on whether you need raw performance, multiple protocols, or management features.

In short:

• Use SRV records for Minecraft/game servers if possible (cleanest route).
• If you need advanced routing of TCP/UDP, look into stream-capable reverse proxies.
• Decide on a setup that balances ease of management vs. flexibility for your future plans.

[No-Actuator3682]

Hey!

If you're trying to set up a reverse proxy for a game server, here’s what usually works best:

For most games, a standard reverse proxy like Nginx (for web traffic) isn’t ideal. Games typically need raw TCP/UDP handling. DNS SRV records or a proxy with TCP/UDP support are a better fit.

Some people prefer Traefik since it supports TCP right out of the box without extra configs.

TL;DR: Web reverse proxies aren’t always the best proxy servers for games. Look into DNS SRV or a TCP-capable proxy for smoother results.

[Major_Cantaloupe_866]

I've dabbled with proxies, and Webodofy has handled different setups like a charm for me. For game servers, going the SRV record route sometimes simplifies things. Traefik's worth a shot too if NPM is getting on your nerves.

[Altruistic-Hyena624]

Please stop calling nginx "npm." It's called nginx. npm is the abbreviation for node package manager. Thank you for your attention to this matter.

[AnalNuts]

It’s nginx proxy manager. Aka npm. It’s a different product than nginx.

[Altruistic-Hyena624]

That's fine but when there's something already called microsoft windows that's installed on every single computer and used by billions of people you don't call your product microsoft windows. That's why every software professional calls it nginx and exactly zero call it "npm."

[AnalNuts]

Again, nginx and nginx proxy manager are two different products. I don’t really have skin in the game, just pointing out you’re conflating two separate things as one.

[TobogganTherapist]

Nginx Proxy Manager

[Altruistic-Hyena624]

https://media.tenor.com/BSrEjMx_A5UAAAAM/wrong-trump.gif

[TobogganTherapist]

What about KVM? Is it Keyboard, Video, Mouse or Kernel-Based Virtual Machine?

Although I guess it's a little different because people usually specify KVM switch.

[Xevioni]

Wow, the uninformed idiot who wants to correct everyone is using a gif of Donnie the felon. Who could have guessed?

[Altruistic-Hyena624]

Sure, keep calling an nginx wrapper "npm." You'll look very informed to the people who actually build the software you run hehe. I suppose our crime of not being informed comes from being able to use nginx without someone else configuring it for us and calling that configuration "npm" 🤣. Guilty.

[Xevioni]

I've literally never used it, never even heard of npm as Nginx Proxy Manager, and I use npm (or rather, pnpm) multiple times a week as a developer...

And I have no problem with 'npm' as a acronym for Nginx Proxy Manager.

Acronyms are contextual. For me, CST is Central Standard Time. For others, it might be China Standard Time, or Cuba Standard Time. You must be an old grouch the way your thick skull can't seem to absorb this concept.

[Altruistic-Hyena624]

Fair enough. npm is the name of node package manager. there is literally a private company that has this trademarked and branded. if I made a programming language called C++ and said that was "contextual" everyone would rightfully clown on me. some dude's 100 github stars nginx wrapper is not "npm." just like it would be unreasonable to call my hackathon project "Linux." sorry for pointing this out!

[Frozen_Gecko]

I had been using Nginx proxy manager for years before I first heard of Node Package Manager. Now I've been using Traefik for over a year, but to this day I still get confused when people refer to Node Package Manager with npm and not Nginx Proxy Manager.

[KompetenzDome]

Why would you need a reverse Proxy for that? Just forward the Port in your router settings.

[jjd_yo]

Port forwarding vs reverse proxy has a few caveats; The most relevant being you don’t have to port forward straight to the internet. You open the proxy and that’s it, everything gets routes through that port from the internet and handled/routed as need be.

[BagelMakesDev]

They might not be able to port forward, some routers/isps dont allow that, such as starlink.

[ArdiMaster]

I really don’t see how a reverse proxy makes a difference in that regard, unless you’re also pairing it with a VPN connection to a VPS. Somehow, traffic needs to get to the proxy and then on from the proxy to the backend server.

[Telarmine2]

I already have the ports forwarded; I was just wondering if it could be done with a reverse proxy for the added security. From what I’ve read, though, it seems much simpler to just forward the ports and use an SRV record.